Assignment 1

1. Output: 32664
Command: tcpdump -n -r hw1.pcap | wc -l

2. Output: ARP - 11304, UDP - 18382
Command: tcpdump -n -r hw1.pcap arp | wc -l
	 tcpdump -n -r hw1.pcap udp | wc -l

3. Output: 28
Command: tcpdump -n -r hw1.pcap "host 192.168.0.200 and host 91.189.90.40" | wc -l

4. Output: 33 Unique IPs

0.0.0.0
122.154.101.54
1.234.31.20
130.75.16.5
159.148.96.184
169.254.56.55
192.168.0.1
192.168.0.10
192.168.0.11
192.168.0.12
192.168.0.2
192.168.0.200
192.168.0.3
192.168.0.5
192.168.0.6
192.168.0.7
194.168.4.100
216.137.63.121
216.137.63.137
46.51.197.88
46.51.197.89
62.252.170.81
62.252.170.91
87.230.23.162
87.98.246.8
91.189.88.33
91.189.89.88
91.189.90.40
91.189.90.41
91.189.91.14
91.189.91.15
91.189.92.190
92.240.68.152

Command: tcpdump -n -r hw1.pcap ip | awk -F ' ' '{print $3}' | awk -F '.' '{print $1 "." $2 "." $3 "." $4}' | sort | uniq | wc -l


5. Output: 10 Unique IPs 

192.168.0.1
192.168.0.10
192.168.0.11
192.168.0.12
192.168.0.2
192.168.0.200
192.168.0.3
192.168.0.5
192.168.0.6
192.168.0.7

Command: tcpdump -n -r hw1.pcap ip src net 192.168/16 | awk -F ' ' '{print $3}' | awk -F '.' '{print $1 "." $2 "." $3 "." $4}' | sort | uniq
	 tcpdump -n -r hw1.pcap ip src net 172.16/12 | awk -F ' ' '{print $3}' | awk -F '.' '{print $1 "." $2 "." $3 "." $4}' | sort | uniq
	 tcpdump -n -r hw1.pcap ip src net 10.0/8 | awk -F ' ' '{print $3}' | awk -F '.' '{print $1 "." $2 "." $3 "." $4}' | sort | uniq

6. Output: 31 Unique IPs

122.154.101.54
1.234.31.20
130.75.16.5
159.148.96.184
169.254.255.255
192.168.0.12
192.168.0.200
192.168.0.255
194.168.4.100
216.137.63.121
216.137.63.137
224.0.0.22
224.0.0.251
224.0.0.252
224.0.0.253
239.255.255.250
255.255.255.255
46.51.197.88
46.51.197.89
62.252.170.81
62.252.170.91
87.230.23.162
87.98.246.8
91.189.88.33
91.189.89.88
91.189.90.40
91.189.90.41
91.189.91.14
91.189.91.15
91.189.92.190
92.240.68.152

Command: tcpdump -n -r hw1.pcap ip | awk -F ' ' '{print $5}' | awk -F '.' '{print $1 "." $2 "." $3 "." $4}' | sed 's/://g' | sort | uniq | wc -l

7. Output
UDP
Count --> Port
13178 --> 1900
1925 --> 137
1516 --> 5355
840 --> 5353
399 --> 138

TCP
Count --> Port
727 --> 80
697 --> 54634
346 --> 49836
61 --> 47110
36 --> 40341

Command: tcpdump -n -r hw1.pcap udp | awk -F ' ' '{print $5}' | cut -d"." -f5 | sed 's/://g' | sort | uniq -c | sort -nr | head -n 5
	 tcpdump -n -r hw1.pcap tcp | awk -F ' ' '{print $5}' | cut -d"." -f5 | sed 's/://g' | sort | uniq -c | sort -nr | head -n 5

8. Output: 75
Command: tcpdump -n -r hw1.pcap tcp | awk -F ' ' '{print $7}' | grep "S" | wc -l

9. Output: 37
Command: tcpdump -n -r hw1.pcap tcp | awk -F ' ' '{print $7}' | grep "\[S\]" | wc -l

10. Output
Count --> Port
33 --> 80
2 --> 9100
1 --> 465
1 --> 443

Command: tcpdump -n -r hw1.pcap tcp | grep "\[S\]" | awk -F ' ' '{print $5}' | awk -F '.' '{print $5}' | sed 's/://g' | sort | uniq -c | sort -nr

11. Output: 94 GET Requests

JPG Urls
1. http://pic.leech.it/i/f166c/479246b0asttas.jpg
2. /i/f166c/479246b0asttas.jpg
3. http://ecx.images-amazon.com/images/I/41oZ1XsiOAL._SL500_AA300_.jpg
4. http://www.nature.com/news/2009/090527/images/459492a-i1.0.jpg
5. /news/2009/090527/images/459492a-i1.0.jpg

Command: tcpdump -Ant -r hw1.pcap ip | grep "HTTP: GET" | wc -l
	 tcpdump -Ant -r hw1.pcap ip | grep "HTTP: GET" | grep ".jpg" | awk -F "GET " '{print $2}' | awk -F " " '{print $1}' | sort | uniq

12. Output: First Packet - 2013-01-12 12:37:42.871346, Last Packet - 2013-01-14 14:27:03.691498

Command: tcpdump -n -tttt -r hw1.pcap | head -n 1 | awk -F ' ' '{print $1 " " $2}'
	 tcpdump -n -tttt -r hw1.pcap | tail -n 1 | awk -F ' ' '{print $1 " " $2}'

13. Output: Mac Address - c4:3d:c7:17:6f:9b (NETGEAR), IP Address - 192.168.0.1

Command: tcpdump -n -e -r hw1.pcap | grep "ethertype" | awk -F ' ' '{print $2 " " $10}' | sed 's/\.[^.]*$//' | sort | uniq -c | sort -nr | head -n 1

14. Output

Count --> Size of Packet
12190 --> 60
2773 --> 331
2759 --> 395
2758 --> 405
2749 --> 340
1740 --> 92
1046 --> 66
1034 --> 1514
887 --> 64
341 --> 91
326 --> 342
279 --> 243
232 --> 63
180 --> 110
165 --> 484
164 --> 475
162 --> 539
161 --> 555
158 --> 527
155 --> 541
146 --> 175
121 --> 120
88 --> 386
88 --> 338
87 --> 74
87 --> 392
87 --> 390
86 --> 394
86 --> 362
86 --> 318
85 --> 398
85 --> 326
62 --> 167
60 --> 165
56 --> 249
54 --> 81
52 --> 82
43 --> 84
40 --> 1033
39 --> 219
36 --> 231
33 --> 460
32 --> 602
28 --> 119
24 --> 42
24 --> 315
22 --> 698
22 --> 246
17 --> 551
17 --> 202
16 --> 245
15 --> 302
15 --> 127
14 --> 87
13 --> 90
13 --> 62
13 --> 489
12 --> 666
12 --> 307
12 --> 168
11 --> 142
10 --> 556
10 --> 542
10 --> 540
10 --> 528
10 --> 485
10 --> 476
10 --> 332
10 --> 330
10 --> 154
10 --> 107
9 --> 284
9 --> 248
8 --> 816
8 --> 75
8 --> 68
7 --> 328
7 --> 149
7 --> 125
6 --> 76
6 --> 69
6 --> 610
6 --> 350
6 --> 333
6 --> 282
6 --> 264
6 --> 1034
5 --> 88
5 --> 817
5 --> 628
5 --> 613
5 --> 329
4 --> 89
4 --> 85
4 --> 79
4 --> 65
4 --> 346
4 --> 345
4 --> 322
4 --> 267
4 --> 254
4 --> 244
4 --> 177
4 --> 170
4 --> 124
4 --> 106
4 --> 1035
3 --> 70
3 --> 497
3 --> 344
3 --> 298
3 --> 269
3 --> 247
3 --> 233
2 --> 95
2 --> 94
2 --> 93
2 --> 77
2 --> 704
2 --> 636
2 --> 630
2 --> 624
2 --> 621
2 --> 615
2 --> 614
2 --> 612
2 --> 611
2 --> 607
2 --> 598
2 --> 593
2 --> 590
2 --> 550
2 --> 546
2 --> 502
2 --> 478
2 --> 418
2 --> 383
2 --> 321
2 --> 310
2 --> 309
2 --> 305
2 --> 294
2 --> 288
2 --> 268
2 --> 266
2 --> 265
2 --> 261
2 --> 257
2 --> 255
2 --> 252
2 --> 236
2 --> 229
2 --> 220
2 --> 208
2 --> 184
2 --> 129
2 --> 1212
2 --> 111
2 --> 105
1 --> 979
1 --> 952
1 --> 926
1 --> 760
1 --> 752
1 --> 746
1 --> 730
1 --> 72
1 --> 694
1 --> 690
1 --> 679
1 --> 678
1 --> 640
1 --> 608
1 --> 601
1 --> 596
1 --> 592
1 --> 588
1 --> 568
1 --> 552
1 --> 548
1 --> 544
1 --> 54
1 --> 535
1 --> 518
1 --> 506
1 --> 482
1 --> 479
1 --> 446
1 --> 433
1 --> 432
1 --> 429
1 --> 428
1 --> 417
1 --> 412
1 --> 396
1 --> 389
1 --> 374
1 --> 372
1 --> 347
1 --> 335
1 --> 320
1 --> 317
1 --> 312
1 --> 308
1 --> 306
1 --> 223
1 --> 207
1 --> 195
1 --> 178
1 --> 171
1 --> 156
1 --> 1469
1 --> 144
1 --> 1218
1 --> 1179
1 --> 1170
1 --> 1162
1 --> 1102


Command: tcpdump -n -e -r hw1.pcap | grep "length" | awk -F " length " '{print $2}' | awk -F " " '{print $1}' | sed 's/://g' | sort | uniq -c | sort -nr